Homomorphic Encryption (HE)

The defining property of HE is the ability to perform addition and multiplication on encrypted values without decryption. Given ciphertexts Enc(a) and Enc(b), a server can compute Enc(a + b) or Enc(a × b) while learning nothing about a or b. This enables third parties to process sensitive data while it remains cryptographically protected throughout the entire computation lifecycle.

HE schemes fall into three categories based on computational depth:

• Partially Homomorphic Encryption (PHE): Supports only one operation type (e.g., RSA for multiplication, Paillier for addition).
• Somewhat Homomorphic Encryption (SHE): Supports both operations but only for circuits of limited depth before noise corrupts the ciphertext.
• Fully Homomorphic Encryption (FHE): Supports arbitrary computation of unlimited depth through bootstrapping, which refreshes ciphertext noise.

Every homomorphic operation introduces noise into the ciphertext. If noise exceeds a threshold, decryption fails. Bootstrapping, introduced by Gentry in 2009, is the process of homomorphically evaluating the decryption circuit itself to produce a refreshed ciphertext with reduced noise. This breakthrough transforms SHE into FHE, enabling unbounded computation depth at the cost of significant computational overhead.

Modern HE schemes derive their security from hard mathematical problems on high-dimensional lattices, primarily the Ring Learning With Errors (RLWE) problem. RLWE is believed to be resistant to attacks by both classical and quantum computers, making HE a post-quantum secure cryptographic primitive. Common schemes include BGV, BFV, CKKS, and TFHE, each optimized for different computation types.

To amortize computational cost, HE schemes support SIMD-style batching, where a single ciphertext encrypts a vector of plaintext values. Operations performed on the ciphertext apply element-wise to all packed values simultaneously. For example, a single homomorphic addition can add thousands of encrypted numbers in parallel, dramatically improving throughput for workloads like encrypted neural network inference.

The most powerful class of HE that supports arbitrary computation on ciphertexts. Unlike Partially Homomorphic Encryption (PHE) which supports only addition or multiplication, FHE enables unlimited depth circuits through a technique called bootstrapping. This allows for the evaluation of any function without decryption, though it incurs significant computational overhead—often 1,000x to 1,000,000x slower than plaintext operations.

A complementary protocol to HE that distributes computation across multiple non-colluding parties. While HE allows a single party to compute on encrypted data, SMPC splits the data itself into secret shares. No single party ever sees the complete input. SMPC is often more efficient for complex operations like comparisons, but requires high-bandwidth communication between parties. Modern systems frequently combine HE and SMPC to optimize for both privacy and performance.

A mathematical framework that provides plausible deniability for individual records. While HE protects data during computation, Differential Privacy protects the output from revealing individual contributions. It works by injecting calibrated statistical noise into query results, governed by a privacy budget parameter epsilon (ε). A lower epsilon means stronger privacy. This is often paired with HE to ensure that even decrypted aggregate results do not leak personal information.

The mathematical foundation underpinning most modern HE schemes. Lattice-based constructions rely on the hardness of problems like Learning With Errors (LWE) and its ring variant (RLWE). These problems involve solving linear equations with small, random noise added. Critically, lattice-based schemes are believed to be quantum-resistant, making them the leading candidate for post-quantum cryptography. The security of schemes like CKKS and BGV directly reduces to the difficulty of these lattice problems.

A hardware-based alternative to HE that creates an encrypted enclave within the CPU. Technologies like Intel SGX and AMD SEV decrypt data inside this isolated boundary for computation, then re-encrypt it before writing to memory. TEEs offer near-native performance but require hardware root of trust in the silicon vendor. Unlike HE, the data exists in plaintext momentarily inside the CPU, making it vulnerable to sophisticated side-channel attacks. The choice between HE and TEE is a trade-off between mathematical guarantees and performance.

A protocol where a prover convinces a verifier that a statement is true without revealing any information beyond the statement's validity. While HE enables private computation, ZKPs enable private verification. In an HE pipeline, ZKPs can prove that the encrypted computation was performed correctly without revealing the inputs or intermediate states. This combination creates a verifiable confidential computing stack, essential for regulatory audits where both privacy and correctness must be guaranteed.